Microsoft 365 Litigation Holds

Discover supports the enabling or disabling of the Microsoft 365 litigation hold status for EWS mailbox, SharePoint, and OneDrive data targets. For SharePoint and OneDrive, the hold status is triggered by specifying a Microsoft Retention Policy to be assigned. These Retention Policies must be configured in the Microsoft 365 tenant by the customer.

To enable this feature, open the Discover settings (pink gear icon), select the Administrative tab, scroll down to the Legal Hold Settings section and select the appropriate parameters. After specifying the hold settings, click the Save button to update your changes.

After the hold settings have been configured, holds may be triggered by selecting a data target, hovering over the green Action button and selecting the option 'Enable Legal Hold on Server'.

Selecting this option marks the data target for legal hold. The process that triggers PowerShell requests to Microsoft 365 to set the litigation hold flag on the Microsoft 365 mailbox/archive, or apply the retention tag that was specified for SharePoint or OneDrive sites runs automatically on a nightly basis. To trigger that process immediately, open the Administration area on the Discover dashboard, select Configuration then Legal Hold Targets. From this view select the targets to implement a hold for, hover over the green Action button and select the 'Run Legal Hold Process'.

This view also provides a recap of any data targets that have previously been placed on hold from Discover.

Notes

Note 1: Microsoft 365 may take up to four hours to update the litigation hold status for a data target.

Note 2: Customers who wish to apply legal holds to a mailbox must make sure that mailbox is licensed for "Litigation Hold" in their Microsoft 365 console. Microsoft requires an Exchange Online plan 2 license (or E3/E4 or equivalent) to place a mailbox on litigation hold. Currently, Discover does not validate that the appropriate license level is applied to the mailbox.